Monash Hub
For parents

Privacy policy

Last updated 2026-10-31

Monash Hub is an unofficial site made by students and is not affiliated with Monash University. This page says what it keeps about you and why.

Your account

  • Signing up asks for an email address, a nickname and a password. Only a bcrypt hash of the password is stored; nobody can read the password itself.
  • You can choose to add a profile picture and a short bio.
  • The site records when the account was created and when it last signed in.
  • No real name, student ID or phone number is collected.

Signing in with Google

  • Only the openid, email and profile scopes are requested, to read your email address, whether Google has verified it, and your display name.
  • The email address finds or creates your account. The display name is used once, to suggest a nickname you can change later.
  • Nothing else from your Google account is read (no Gmail, Drive or contacts), and no Google access token is kept.
  • A cookie lasting at most ten minutes confirms that the sign-in finishes in the browser that started it, and is deleted when it does.

What you post

  • Community posts, answers and unit ratings are public and shown with your nickname.
  • You can rate without an account: your browser makes up a random key so you can edit or remove that rating later.
  • When someone answers your post, the site creates a notification for you.

Email

Codes for signing up and resetting a password are sent to your address through an email delivery service. Only a hash of each code is stored, and codes expire.

Abuse protection

To limit password guessing and request floods, the site briefly counts failed sign-ins, code requests, reports and ratings by email address or network address, and deletes the counts when they expire. The web server's access log also records network addresses.

The Ask panel

A question typed into the Ask panel is also sent to the 马莫百科 WeChat bot to add to the answer, together with a random key your browser makes up. Your account details are not sent.

Stored in your browser

  • Your signed-in session token is kept in the browser's localStorage and cleared when you sign out.
  • Study plans are kept only in your browser. Checking a plan sends it to the server, which does not store it.
  • Your interface language is kept in a cookie called mh_locale.
  • The site uses no advertising or third-party analytics trackers.

What we do not do

Your personal information is not sold, rented or used for advertising.

Deleting your account and contact

To delete your account, get a copy of your data, or ask about this policy, email wensx0926@gmail.com.